🇫🇷
dynamix
2026-10-25 11:37:40
(3 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
lightaffaire
2026-10-24 17:02:50
(4 days ago)
Oct 24 19:02:48 www.lightaffaire.com 172.71.144.130 - - [24/Oct/2026:19:02:48 +0200] "GET //phpinfo.php HTTP/2.0" 404 2867 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
...
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-23 23:31:06
(5 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
FeG Deutschland
2026-10-23 20:59:22
(5 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇩🇪
shurizma
2026-10-22 21:49:59
(6 days ago)
[22/Oct/2026:21:49:58 +0000] - 404 404 - GET https shuri.gg "/wp-login.php" [Client 172.71.144.130] [Length 176] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/53 ...
show more
[22/Oct/2026:21:49:58 +0000] - 404 404 - GET https shuri.gg "/wp-login.php" [Client 172.71.144.130] [Length 176] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36" "-"
...
show less
Web App Attack
Bad Web Bot
🇫🇷
dynamix
2026-10-21 01:33:35
(1 week ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-19 03:33:42
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 15:15:59
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 11:15:53.608993 2026] [security2:error] [pid 17016:tid 17016] [client 172.71.144.130:12169] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 11:15:53.608993 2026] [security2:error] [pid 17016:tid 17016] [client 172.71.144.130:12169] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cobbwebb.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cobbwebb.net"] [uri "/config.php.bak"] [unique_id "atTiqQSmaFMp3f7gkgUl1AAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 08:26:56
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:26:48.443495 2026] [security2:error] [pid 15045:tid 15045] [client 172.71.144.130:9368] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:26:48.443495 2026] [security2:error] [pid 15045:tid 15045] [client 172.71.144.130:9368] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||w0kem.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "w0kem.com"] [uri "/dump.sql"] [unique_id "atSCyEbrCAxmo0MZUZv-_QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:01:57
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:01:49.264932 2026] [security2:error] [pid 25241:tid 25241] [client 172.71.144.130:10411] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:01:49.264932 2026] [security2:error] [pid 25241:tid 25241] [client 172.71.144.130:10411] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||ahelfrick.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ahelfrick.com"] [uri "/backup.sql"] [unique_id "atRu3SFlm0Wn6h7pcpYAhAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:40:10
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:40:04.283042 2026] [security2:error] [pid 25261:tid 25261] [client 172.71.144.130:9816] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:40:04.283042 2026] [security2:error] [pid 25261:tid 25261] [client 172.71.144.130:9816] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||unitoolsupplies.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "unitoolsupplies.com"] [uri "/rezerv.sql"] [unique_id "atPrNOFzYNqcdzp2M637FAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:05:16
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:05:13.447406 2026] [security2:error] [pid 29867:tid 29880] [client 172.71.144.130:9879] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:05:13.447406 2026] [security2:error] [pid 29867:tid 29880] [client 172.71.144.130:9879] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pixelpushersdesign.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pixelpushersdesign.com"] [uri "/db.sql"] [unique_id "atPU-cK6G5uQ2Z49pjUAOAAAAIQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-14 02:46:46
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 02:08:54
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 22:08:46.578237 2026] [security2:error] [pid 15370:tid 15370] [client 172.71.144.130:12132] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 22:08:46.578237 2026] [security2:error] [pid 15370:tid 15370] [client 172.71.144.130:12132] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.vaghyst.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.vaghyst.com"] [uri "/db.sql"] [unique_id "as7kLiqHPEdnH6FqKGtAXgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:58:07
(2 weeks ago)
(mod_security) mod_security (id:949110) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:57:59.637572 2026] [security2:error] [pid 20033:tid 20033] [client 172.71.144.130:13275] ...
show more
(mod_security) mod_security (id:949110) triggered by 172.71.144.130 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:57:59.637572 2026] [security2:error] [pid 20033:tid 20033] [client 172.71.144.130:13275] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "789-bid.net"] [uri "/rezerv.sql"] [unique_id "as7Tl7SC0Xqx_1v7BISamQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
